If 'app_repo="[email protected]:EPFL-ENAC/unhcr-geneva-tech-hub-app.git". in an inventory uses git (ssh protocol) instead of https.
We won't be able to deploy using the api because the we probably don't have the deploy key of the repository

example:
https://github.com/EPFL-ENAC/unhcr-geneva-tech-hub-app/actions/runs/4913298114/jobs/8773327998

problem

we can switch to https for public repository; but for private repository it won't be possible to deploy.

Do we do something?

Is it the expected behavior ? For instance resslab-hub is a private repo... https://github.com/RESSLab-Team/resslab-hub

enac-cd-app's logs must be useful.

1. have datetime stamp
2. correct client IP (not the reverse proxy)
3. maybe include enacit-ansible's output ?

Is there an existing issue for this?

• I have searched the existing issues

Current Behavior

When unreachable on ansible result. the json return 'finished' instead of 'error'

Friday 05 May 2023  15:06:47 +0000 (0:00:00.041)       0:00:00.041 ************ 
fatal: [***]: UNREACHABLE! => {"changed": false, "msg": "Failed to connect to the host via ssh: Failed to add the host to the list of known hosts (/root/.ssh/known_hosts).\r\n@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@\r\n@         WARNING: UNPROTECTED PRIVATE KEY FILE!          @\r\n@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@\r\nPermissions 0664 for '/root/.ssh/id_ed25519' are too open.\r\nIt is required that your private key files are NOT accessible by others.\r\nThis private key will be ignored.\r\nLoad key \"/root/.ssh/id_ed25519\": bad permissions\r\nroot@***: Permission denied (publickey,password).", "unreachable": true}

PLAY RECAP *********************************************************************
***     : ok=0    changed=0    unreachable=1    failed=0    skipped=0    rescued=0    ignored=0   

Friday 05 May 2023  15:06:48 +0000 (0:00:00.099)       0:00:00.141 ************ 
=============================================================================== 
Gathering Facts --------------------------------------------------------- 0.10s
Process return code: 4
Deployment finished!

Expected Behavior

We should have an error, so we can return an exit code of 1;

Steps To Reproduce

No response

Environment

- OS:
- Node:
- npm:

Anything else?

No response

In my_docker.py, replace hardcoded path /opt/enac-cd-app/ by an environment var ENAC_CD_APP_ROOT defined in .env

What we currently have

** When deploying multiple time (several github actions running on the same time)

• the first time we have a job_id
• the second time we have an error because it's already running

It's making it not obvious in the CD that the deployment was successful.

What I wish we had

** When deploying multiple time (several github actions running on the same time)

• the first time we have a job_id
• the second time we have the same job_id a status="running" because it's already running
• We don't have a status=error, we may have an additional information regarding the fact that it was running before (timestamp or something else

That way, we will only see 'real failure' in the github actions pipelines. Instead of having 'failed deploy prod' which is not the case.

Should accept a parameter that let Icinga2 choose what to check and what are the thresholds.

metrics={
    "1 hour": 3600,
    "1 day": 86400,
    "1 week": 604800
}

Currently, an enacit-ansible container is launched to run the app-deploy. It will periodically send it's status and output to the enac-cd-app to let the client know of the progress.

This works quite ok, but will never work if the container itself crashes.
In case of crash, the deployment will stay "running" until the Redis timeout which is a really big problem.

Solution: Don't require enacit-ansible to let know of its status. Instead, everytime the client asks for the progress, enac-cd-app will consult the launched container for its output (and state in case of crash).

We don't need Redis to be accessible from the internet. Close it as it's an unnecessary security risk.